Usable with caveats. The package has a matching repository, tests, release notes, and a clean stable release, but it has had no registry releases for about four years and no commits in the last three months. The missing license and limited security practices add transparency and maintenance concerns.
62%
Total Score
67
100
78
75
No declared license or license file was found in the package or repository. That creates a real legal and transparency concern for dependency use.
The package has six releases, but none in the last 12 months and its latest release was about four years ago. This suggests the project may be mature or dormant, so it lowers confidence in ongoing maintenance.
There were no commits and no active maintainers in the last three months, while the repository's last push was about two and a half years ago. This is the main abandonment-risk signal.
There are four open issues and two open pull requests, with no issues or pull requests closed in the last month. This is consistent with limited recent project activity.
The repository has only five stars and seven forks, indicating a small user and contributor base. Low popularity is supporting evidence rather than a decisive problem, but it provides little external resilience.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
statamic/cms Version ^3.3 | — | — |
voku/html-min Version ^4.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.